The other Joomla RCE: how CVE-2026-48907 turns the JCE editor into a PHP webshell
Two Joomla extensions each earned a CVSS 9.8 unauthenticated RCE in June 2026 — and both are now in CISA KEV. But their EPSS scores differ roughly 50-fold, and that gap is the real triage signal.
In June 2026, two different Joomla extensions each shipped with a CVSS 9.8 unauthenticated remote code execution flaw. Same score, same vector string, both ending in PHP on your server, and — as of now — both on CISA's Known Exploited Vulnerabilities list. If you triage purely by CVSS, or even by KEV alone, they look interchangeable. They aren't. CVE-2026-48907, in the JCE editor extension, carries an EPSS in the 99.6th percentile — an ~80% modeled exploitation probability. Its sibling sits near 1.6%. This is a breakdown of the JCE bug, and of why that ~50× gap between two KEV entries is the number that should drive your patch order.
What the bug actually is
JCE — JoomlaContentEditor, published by Widget Factory Limited — is one of the most widely installed rich-text editor extensions in the Joomla ecosystem. CVE-2026-48907 is classed as CWE-284 (Improper Access Control). The flaw lets an unauthenticated request create new editor profiles. Those profiles govern what the editor's file browser and upload features are allowed to do — so once an attacker can mint one, the path from "no account" to "upload and execute PHP" is open.
| Field | Value |
|---|---|
| CVE | CVE-2026-48907 |
| Affected | JCE for Joomla, 1.0.0 through 2.9.99.4 (i.e. < 2.9.99.5) |
| Vendor | Widget Factory Limited (joomlacontenteditor.net) |
| Weakness | CWE-284 — Improper Access Control |
| CVSS 3.1 | 9.8 Critical — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 0.804 (80.4%), 99.6th percentile |
| CISA KEV | Listed |
| Fix | Upgrade to 2.9.99.5 (no vendor workaround) |
| Published | 2026-06-05 (NVD) |
The attack path
Unauthenticated request to PHP execution
- Unauthenticated attacker — No Joomla account, network reach to the site
- Abuse access-control flaw (CWE-284) — Create / alter an editor profile without authentication
- Profile grants file-browser + upload rights — The new profile permits the JCE file manager
- Upload PHP payload — Get a .php file into a web-served path
- Execute → webshell / RCE — Full code execution in the web server context
Same 9.8, same KEV, very different EPSS: JCE vs SP Page Builder
Two weeks after JCE, a second Joomla extension picked up an identically-scored flaw: CVE-2026-48908 in SP Page Builder (JoomShaper), an unauthenticated arbitrary file upload (CWE-434) that also ends in PHP execution. Both are CVSS 9.8 with the exact same vector, and both are now KEV-listed. So severity doesn't separate them, and neither does KEV. What does is EPSS — the model's estimate of exploitation likelihood.
| Label | Value |
|---|---|
| CVE-2026-48907 (JCE) | 80.4 |
| CVE-2026-48908 (SP Page Builder) | 1.6 |
CVE-2026-48907 vs CVE-2026-48908
| CVE-2026-48907 (JCE editor) | CVE-2026-48908 (SP Page Builder) | |
|---|---|---|
| Root cause | CWE-284 improper access control → create editor profile | CWE-434 unrestricted file upload |
| Attack shape | Two-stage: authz bypass → upload → execute | Direct: upload → execute |
| CVSS 3.1 | 9.8 (AV:N/AC:L/PR:N/UI:N) | 9.8 (AV:N/AC:L/PR:N/UI:N) |
| In CISA KEV | Yes | Yes |
| EPSS | 80.4% (99.6th pct) | 1.6% (72.6th pct) |
| Fixed in | 2.9.99.5 | 6.6.2 |
Timeline
JCE RCE — disclosure to active exploitation
- CVE-2026-48907 publishedJCE editor unauthenticated RCE disclosed via NVD; fix available in 2.9.99.5.
- NVD record last updatedEnrichment and references finalized on the CVE record.
- Sibling CVE-2026-48908 publishedSP Page Builder for Joomla — a second 9.8 unauthenticated RCE (CWE-434). Also now KEV-listed, but with far lower EPSS (~1.6%).
- CVE-2026-48907 added to CISA KEVListed in the Known Exploited Vulnerabilities catalog — active exploitation confirmed. Date per CISA KEV entry.
- Active-exploitation coverage resurfacesThreat-intel reporting flagged a renewed wave of CMS/plugin exploitation delivering webshells. Reported, not independently verified here.
Exploitation status — the honest version
Be precise about what "exploited" means here. The CISA KEV listing is the authoritative signal that this is being used in the wild. Separately, cve.tools' own exploit index shows no packaged Metasploit or Nuclei module for CVE-2026-48907 — but the CVE's references do point to a public proof-of-concept repository and third-party exploitation write-ups. In other words: no push-button module in the mainstream frameworks yet, but working exploit knowledge is public and the flaw is confirmed under active attack. Treat it as exploitable now.
What to do
- Upgrade JCE to 2.9.99.5 or later. This is the fix; there is no vendor workaround.
- If you run an older or end-of-life Joomla site that can't take the full update, the vendor published a free standalone patch for older sites — apply it (see the advisory).
- Assume compromise on any internet-facing Joomla site running JCE < 2.9.99.5. Hunt for unexpected .php files in upload/media paths, new or altered editor profiles, and web-server processes spawning shells.
- Patch SP Page Builder too if you run it: CVE-2026-48908 is the same 9.8 class of bug and also KEV-listed — fixed in 6.6.2 — even though its EPSS signal is far lower.
- Rotate secrets and review admin accounts if you find any indicator; a PHP webshell means full web-context code execution.
Data as of 2026-07-19live record →